Hi,
I'm using python to pull event logs from remote machine using ms-even6 interface (https://msdn.microsoft.com/en-us/library/cc231282.aspx).
I used EvtRpcRegisterLogQuery and EvtRpcQueryNext functions which produce a byte array that contains the BinXml data of the event. While having some issues with the parsing, I came through your project. From my understanding, Evtx also contains the event as BinXml format, however, my code does not produce any chunk nor record, but only the actual BinXml format, I can't seem to understand how exactly to use your code in order to parse it correctly.
So my questions are:
- Are these two binxml structures are indentical? (my guess is yes)
- How can I use your code in order to parse BinXml byte array into the actual xml?
Thanks!
Hi,
I'm using python to pull event logs from remote machine using ms-even6 interface (https://msdn.microsoft.com/en-us/library/cc231282.aspx).
I used EvtRpcRegisterLogQuery and EvtRpcQueryNext functions which produce a byte array that contains the BinXml data of the event. While having some issues with the parsing, I came through your project. From my understanding, Evtx also contains the event as BinXml format, however, my code does not produce any chunk nor record, but only the actual BinXml format, I can't seem to understand how exactly to use your code in order to parse it correctly.
So my questions are:
Thanks!